Vidoc Security Lab

Securing how the world builds software

[Vidoc Security Lab @vidocsecurity]

Your password is incorrect. Please add more characters.

[International Cyber Digest @IntCyberDigest]

The bug is like a joke.

On Alpine Linux, type 257 to 1024 characters of anything and you get root. 💀

[Vidoc Security Lab @vidocsecurity]

@cyber_razz @kannthu can you remind him he has a company

[Vidoc Security Lab @vidocsecurity]

@yeahbutnahbut @kannthu From finding cracks in code to fixing cracks in floors

[Vidoc Security Lab @vidocsecurity]

@MrJohnMBartlett @kannthu Us after seeing his post

[Vidoc Security Lab @vidocsecurity]

@thedealdirector @kannthu he said he needed to patch something. we assumed Linux ;)

[Vidoc Security Lab @vidocsecurity]

@realpufferfish1 @kannthu From now on, he'll be laying the floors like this

[Vidoc Security Lab @vidocsecurity]

@mfreeman451 @kannthu so these are the vulnerabilities everyone keeps talking about

[Vidoc Security Lab @vidocsecurity]

@KazymirR @kannthu "ground-level security" was very literal, I guess

[Vidoc Security Lab @vidocsecurity]

@pravetz386 @kannthu btw, check us out https://t.co/IqHrnA5Kar

[Vidoc Security Lab @vidocsecurity]

@pravetz386 @kannthu this is also how we found out

[Vidoc Security Lab @vidocsecurity]

@rocketjobs_pl situation under control, the floor guy is still our CTO ;)

[Vidoc Security Lab @vidocsecurity]

How much does it cost to scan the entire PHP codebase with AI?

@gregxsunday tested 6 frontier models and calculated the projected cost of a full scan based on our results.

The cheapest: DeepSeek V4.1 Flash at ~$800.
The most expensive: Claude Opus 5.5 at ~$18,200.

That's over a 22x difference for a single scan.

Full breakdown in our recent article.

[Vidoc Security Lab @vidocsecurity]

.@gregxsunday tested 6 AI models on PHP2Shell.

GPT-5.6 Sol: 11.7 findings, 1 related ($23.63/run)

Gemini 4 Argon: 5.3 findings, 1.3 related ($14.06/run)

Opus 5.5: 0 related ($33.87/run)

Estimated cost to scan the entire PHP codebase - $800-$18,200.

Full results in our recent article.

[Vidoc Security Lab @vidocsecurity]

Last week's PHP2Shell vulnerability was discovered through OpenAI's Patch the Planet initiative.

But can you really find critical bugs just by asking an LLM?

We tested six frontier models on vulnerable PHP code to see what they'd catch and at what cost. https://t.co/e7lD6p6xCK

[Dawid Moczadlo @kannthu]

GLM 5.3 is dangerous... dangerously good for cybersecurity; great at reversing, finding bugs, and creating exploits

This is why we are giving it away for free to the security community! No guardrails, no refusals

If you are a defender and want to get more tokens, please reach out!

https://t.co/FW7YahnnhH

[Vidoc Security Lab @vidocsecurity]

@gregxsunday tested Jev on 31 real vulnerability reports before we considered using it inside VIDOC.

He compared it with 7 other models to see whether the speed and low cost were worth the trade-off in accuracy.

Full results below ↓

[Bug Bounty Reports Explained @gregxsunday]

I wondered whether Jev can be used for vulnerability detection so I made a little test. And it didn't do that well
Link below⬇️

[Vidoc Security Lab @vidocsecurity]

@llm_redteam None. We take the security part pretty seriously :)

[Vidoc Security Lab @vidocsecurity]

This is VIDOC.

Anything your security engineer can do on a computer, VIDOC can do for you. Fast.

[Vidoc Security Lab @vidocsecurity]

@hsalosec There is NO doubt ;) https://t.co/1wbVWPcptH

[Dawid Moczadlo @kannthu]

Our harness discovered multiple 0-days in networking stack of Linux Kernel (using publicly accessible LLMs)

This is one of many CVEs to come

Thank you @GuanniQu for great collaboration!!